No OneTemporary
Actions

Size

90 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/lib/pleroma/plugs/auth_expected_plug.ex b/lib/pleroma/plugs/auth_expected_plug.ex
	new file mode 100644
	index 0000000000..9e4a4bec85
	--- /dev/null
	+++ b/lib/pleroma/plugs/auth_expected_plug.ex
	@@ -0,0 +1,13 @@
	+# Pleroma: A lightweight social networking server
	+# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	+# SPDX-License-Identifier: AGPL-3.0-only
	+
	+defmodule Pleroma.Plugs.AuthExpectedPlug do
	+ import Plug.Conn
	+
	+ def init(options), do: options
	+
	+ def call(conn, _) do
	+ put_private(conn, :auth_expected, true)
	+ end
	+end
	diff --git a/lib/pleroma/plugs/oauth_scopes_plug.ex b/lib/pleroma/plugs/oauth_scopes_plug.ex
	index 38df074adf..b09e1bb4dd 100644
	--- a/lib/pleroma/plugs/oauth_scopes_plug.ex
	+++ b/lib/pleroma/plugs/oauth_scopes_plug.ex
	@@ -1,79 +1,82 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Plugs.OAuthScopesPlug do
	import Plug.Conn
	import Pleroma.Web.Gettext

	alias Pleroma.Config
	alias Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug
	+ alias Pleroma.Plugs.PlugHelper

	@behaviour Plug

	def init(%{scopes: _} = options), do: options

	def call(%Plug.Conn{assigns: assigns} = conn, %{scopes: scopes} = options) do
	+ conn = PlugHelper.append_to_called_plugs(conn, __MODULE__)
	+
	op = options[:op] \|\| :\|
	token = assigns[:token]

	scopes = transform_scopes(scopes, options)
	matched_scopes = (token && filter_descendants(scopes, token.scopes)) \|\| []

	cond do
	token && op == :\| && Enum.any?(matched_scopes) ->
	conn

	token && op == :& && matched_scopes == scopes ->
	conn

	options[:fallback] == :proceed_unauthenticated ->
	conn
	\|> assign(:user, nil)
	\|> assign(:token, nil)
	\|> maybe_perform_instance_privacy_check(options)

	true ->
	missing_scopes = scopes -- matched_scopes
	permissions = Enum.join(missing_scopes, " #{op} ")

	error_message =
	dgettext("errors", "Insufficient permissions: %{permissions}.", permissions: permissions)

	conn
	\|> put_resp_content_type("application/json")
	\|> send_resp(:forbidden, Jason.encode!(%{error: error_message}))
	\|> halt()
	end
	end

	@doc "Filters descendants of supported scopes"
	def filter_descendants(scopes, supported_scopes) do
	Enum.filter(
	scopes,
	fn scope ->
	Enum.find(
	supported_scopes,
	&(scope == &1 \|\| String.starts_with?(scope, &1 <> ":"))
	)
	end
	)
	end

	@doc "Transforms scopes by applying supported options (e.g. :admin)"
	def transform_scopes(scopes, options) do
	if options[:admin] do
	Config.oauth_admin_scopes(scopes)
	else
	scopes
	end
	end

	defp maybe_perform_instance_privacy_check(%Plug.Conn{} = conn, options) do
	if options[:skip_instance_privacy_check] do
	conn
	else
	EnsurePublicOrAuthenticatedPlug.call(conn, [])
	end
	end
	end
	diff --git a/lib/pleroma/plugs/plug_helper.ex b/lib/pleroma/plugs/plug_helper.ex
	new file mode 100644
	index 0000000000..4f83e94140
	--- /dev/null
	+++ b/lib/pleroma/plugs/plug_helper.ex
	@@ -0,0 +1,38 @@
	+# Pleroma: A lightweight social networking server
	+# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	+# SPDX-License-Identifier: AGPL-3.0-only
	+
	+defmodule Pleroma.Plugs.PlugHelper do
	+ @moduledoc "Pleroma Plug helper"
	+
	+ def append_to_called_plugs(conn, plug_module) do
	+ append_to_private_list(conn, :called_plugs, plug_module)
	+ end
	+
	+ def append_to_skipped_plugs(conn, plug_module) do
	+ append_to_private_list(conn, :skipped_plugs, plug_module)
	+ end
	+
	+ def plug_called?(conn, plug_module) do
	+ contained_in_private_list?(conn, :called_plugs, plug_module)
	+ end
	+
	+ def plug_skipped?(conn, plug_module) do
	+ contained_in_private_list?(conn, :skipped_plugs, plug_module)
	+ end
	+
	+ def plug_called_or_skipped?(conn, plug_module) do
	+ plug_called?(conn, plug_module) \|\| plug_skipped?(conn, plug_module)
	+ end
	+
	+ defp append_to_private_list(conn, private_variable, value) do
	+ list = conn.private[private_variable] \|\| []
	+ modified_list = Enum.uniq(list ++ [value])
	+ Plug.Conn.put_private(conn, private_variable, modified_list)
	+ end
	+
	+ defp contained_in_private_list?(conn, private_variable, value) do
	+ list = conn.private[private_variable] \|\| []
	+ value in list
	+ end
	+end
	diff --git a/lib/pleroma/web/masto_fe_controller.ex b/lib/pleroma/web/masto_fe_controller.ex
	index 43649ad261..557cde328f 100644
	--- a/lib/pleroma/web/masto_fe_controller.ex
	+++ b/lib/pleroma/web/masto_fe_controller.ex
	@@ -1,57 +1,57 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastoFEController do
	use Pleroma.Web, :controller

	alias Pleroma.Plugs.OAuthScopesPlug
	alias Pleroma.User

	plug(OAuthScopesPlug, %{scopes: ["write:accounts"]} when action == :put_settings)

	# Note: :index action handles attempt of unauthenticated access to private instance with redirect
	plug(
	OAuthScopesPlug,
	%{scopes: ["read"], fallback: :proceed_unauthenticated, skip_instance_privacy_check: true}
	when action == :index
	)

	- plug(Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug when action != :index)
	+ plug(Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug when action not in [:index, :manifest])

	@doc "GET /web/*path"
	def index(%{assigns: %{user: user, token: token}} = conn, _params)
	when not is_nil(user) and not is_nil(token) do
	conn
	\|> put_layout(false)
	\|> render("index.html",
	token: token.token,
	user: user,
	custom_emojis: Pleroma.Emoji.get_all()
	)
	end

	def index(conn, _params) do
	conn
	\|> put_session(:return_to, conn.request_path)
	\|> redirect(to: "/web/login")
	end

	@doc "GET /web/manifest.json"
	def manifest(conn, _params) do
	conn
	\|> render("manifest.json")
	end

	@doc "PUT /api/web/settings"
	def put_settings(%{assigns: %{user: user}} = conn, %{"data" => settings} = _params) do
	with {:ok, _} <- User.mastodon_settings_update(user, settings) do
	json(conn, %{})
	else
	e ->
	conn
	\|> put_status(:internal_server_error)
	\|> json(%{error: inspect(e)})
	end
	end
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/account_controller.ex b/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
	index 21bc3d5a54..bd6853d121 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/account_controller.ex
	@@ -1,374 +1,379 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.AccountController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper,
	only: [add_link_headers: 2, truthy_param?: 1, assign_account_by_id: 2, json_response: 3]

	alias Pleroma.Plugs.OAuthScopesPlug
	alias Pleroma.Plugs.RateLimiter
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.MastodonAPI.ListView
	alias Pleroma.Web.MastodonAPI.MastodonAPI
	+ alias Pleroma.Web.MastodonAPI.MastodonAPIController
	alias Pleroma.Web.MastodonAPI.StatusView
	alias Pleroma.Web.OAuth.Token
	alias Pleroma.Web.TwitterAPI.TwitterAPI

	+ plug(:skip_plug, OAuthScopesPlug when action == :identity_proofs)
	+
	plug(
	OAuthScopesPlug,
	%{fallback: :proceed_unauthenticated, scopes: ["read:accounts"]}
	when action == :show
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["read:accounts"]}
	when action in [:endorsements, :verify_credentials, :followers, :following]
	)

	plug(OAuthScopesPlug, %{scopes: ["write:accounts"]} when action == :update_credentials)

	plug(OAuthScopesPlug, %{scopes: ["read:lists"]} when action == :lists)

	plug(
	OAuthScopesPlug,
	%{scopes: ["follow", "read:blocks"]} when action == :blocks
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["follow", "write:blocks"]} when action in [:block, :unblock]
	)

	plug(OAuthScopesPlug, %{scopes: ["read:follows"]} when action == :relationships)

	# Note: :follows (POST /api/v1/follows) is the same as :follow, consider removing :follows
	plug(
	OAuthScopesPlug,
	%{scopes: ["follow", "write:follows"]} when action in [:follows, :follow, :unfollow]
	)

	plug(OAuthScopesPlug, %{scopes: ["follow", "read:mutes"]} when action == :mutes)

	plug(OAuthScopesPlug, %{scopes: ["follow", "write:mutes"]} when action in [:mute, :unmute])

	plug(
	Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug
	when action not in [:create, :show, :statuses]
	)

	@relationship_actions [:follow, :unfollow]
	@needs_account ~W(followers following lists follow unfollow mute unmute block unblock)a

	plug(
	RateLimiter,
	[name: :relation_id_action, params: ["id", "uri"]] when action in @relationship_actions
	)

	plug(RateLimiter, [name: :relations_actions] when action in @relationship_actions)
	plug(RateLimiter, [name: :app_account_creation] when action == :create)
	plug(:assign_account_by_id when action in @needs_account)

	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)

	@doc "POST /api/v1/accounts"
	def create(
	%{assigns: %{app: app}} = conn,
	%{"username" => nickname, "password" => _, "agreement" => true} = params
	) do
	params =
	params
	\|> Map.take([
	"email",
	"captcha_solution",
	"captcha_token",
	"captcha_answer_data",
	"token",
	"password"
	])
	\|> Map.put("nickname", nickname)
	\|> Map.put("fullname", params["fullname"] \|\| nickname)
	\|> Map.put("bio", params["bio"] \|\| "")
	\|> Map.put("confirm", params["password"])

	with :ok <- validate_email_param(params),
	{:ok, user} <- TwitterAPI.register_user(params, need_confirmation: true),
	{:ok, token} <- Token.create_token(app, user, %{scopes: app.scopes}) do
	json(conn, %{
	token_type: "Bearer",
	access_token: token.token,
	scope: app.scopes,
	created_at: Token.Utils.format_created_at(token)
	})
	else
	{:error, errors} -> json_response(conn, :bad_request, errors)
	end
	end

	def create(%{assigns: %{app: _app}} = conn, _) do
	render_error(conn, :bad_request, "Missing parameters")
	end

	def create(conn, _) do
	render_error(conn, :forbidden, "Invalid credentials")
	end

	defp validate_email_param(%{"email" => _}), do: :ok

	defp validate_email_param(_) do
	case Pleroma.Config.get([:instance, :account_activation_required]) do
	true -> {:error, %{"error" => "Missing parameters"}}
	_ -> :ok
	end
	end

	@doc "GET /api/v1/accounts/verify_credentials"
	def verify_credentials(%{assigns: %{user: user}} = conn, _) do
	chat_token = Phoenix.Token.sign(conn, "user socket", user.id)

	render(conn, "show.json",
	user: user,
	for: user,
	with_pleroma_settings: true,
	with_chat_token: chat_token
	)
	end

	@doc "PATCH /api/v1/accounts/update_credentials"
	def update_credentials(%{assigns: %{user: original_user}} = conn, params) do
	user = original_user

	user_params =
	[
	:no_rich_text,
	:locked,
	:hide_followers_count,
	:hide_follows_count,
	:hide_followers,
	:hide_follows,
	:hide_favorites,
	:show_role,
	:skip_thread_containment,
	:allow_following_move,
	:discoverable
	]
	\|> Enum.reduce(%{}, fn key, acc ->
	add_if_present(acc, params, to_string(key), key, &{:ok, truthy_param?(&1)})
	end)
	\|> add_if_present(params, "display_name", :name)
	\|> add_if_present(params, "note", :bio)
	\|> add_if_present(params, "avatar", :avatar)
	\|> add_if_present(params, "header", :banner)
	\|> add_if_present(params, "pleroma_background_image", :background)
	\|> add_if_present(
	params,
	"fields_attributes",
	:raw_fields,
	&{:ok, normalize_fields_attributes(&1)}
	)
	\|> add_if_present(params, "pleroma_settings_store", :pleroma_settings_store)
	\|> add_if_present(params, "default_scope", :default_scope)
	\|> add_if_present(params, "actor_type", :actor_type)

	changeset = User.update_changeset(user, user_params)

	with {:ok, user} <- User.update_and_set_cache(changeset) do
	if original_user != user, do: CommonAPI.update(user)

	render(conn, "show.json", user: user, for: user, with_pleroma_settings: true)
	else
	_e -> render_error(conn, :forbidden, "Invalid request")
	end
	end

	defp add_if_present(map, params, params_field, map_field, value_function \\ &{:ok, &1}) do
	with true <- Map.has_key?(params, params_field),
	{:ok, new_value} <- value_function.(params[params_field]) do
	Map.put(map, map_field, new_value)
	else
	_ -> map
	end
	end

	defp normalize_fields_attributes(fields) do
	if Enum.all?(fields, &is_tuple/1) do
	Enum.map(fields, fn {_, v} -> v end)
	else
	fields
	end
	end

	@doc "GET /api/v1/accounts/relationships"
	def relationships(%{assigns: %{user: user}} = conn, %{"id" => id}) do
	targets = User.get_all_by_ids(List.wrap(id))

	render(conn, "relationships.json", user: user, targets: targets)
	end

	# Instead of returning a 400 when no "id" params is present, Mastodon returns an empty array.
	def relationships(%{assigns: %{user: _user}} = conn, _), do: json(conn, [])

	@doc "GET /api/v1/accounts/:id"
	def show(%{assigns: %{user: for_user}} = conn, %{"id" => nickname_or_id}) do
	with %User{} = user <- User.get_cached_by_nickname_or_id(nickname_or_id, for: for_user),
	true <- User.visible_for?(user, for_user) do
	render(conn, "show.json", user: user, for: for_user)
	else
	_e -> render_error(conn, :not_found, "Can't find user")
	end
	end

	@doc "GET /api/v1/accounts/:id/statuses"
	def statuses(%{assigns: %{user: reading_user}} = conn, params) do
	with %User{} = user <- User.get_cached_by_nickname_or_id(params["id"], for: reading_user),
	true <- User.visible_for?(user, reading_user) do
	params =
	params
	\|> Map.put("tag", params["tagged"])
	\|> Map.delete("godmode")

	activities = ActivityPub.fetch_user_activities(user, reading_user, params)

	conn
	\|> add_link_headers(activities)
	\|> put_view(StatusView)
	\|> render("index.json", activities: activities, for: reading_user, as: :activity)
	else
	_e -> render_error(conn, :not_found, "Can't find user")
	end
	end

	@doc "GET /api/v1/accounts/:id/followers"
	def followers(%{assigns: %{user: for_user, account: user}} = conn, params) do
	followers =
	cond do
	for_user && user.id == for_user.id -> MastodonAPI.get_followers(user, params)
	user.hide_followers -> []
	true -> MastodonAPI.get_followers(user, params)
	end

	conn
	\|> add_link_headers(followers)
	\|> render("index.json", for: for_user, users: followers, as: :user)
	end

	@doc "GET /api/v1/accounts/:id/following"
	def following(%{assigns: %{user: for_user, account: user}} = conn, params) do
	followers =
	cond do
	for_user && user.id == for_user.id -> MastodonAPI.get_friends(user, params)
	user.hide_follows -> []
	true -> MastodonAPI.get_friends(user, params)
	end

	conn
	\|> add_link_headers(followers)
	\|> render("index.json", for: for_user, users: followers, as: :user)
	end

	@doc "GET /api/v1/accounts/:id/lists"
	def lists(%{assigns: %{user: user, account: account}} = conn, _params) do
	lists = Pleroma.List.get_lists_account_belongs(user, account)

	conn
	\|> put_view(ListView)
	\|> render("index.json", lists: lists)
	end

	@doc "POST /api/v1/accounts/:id/follow"
	def follow(%{assigns: %{user: %{id: id}, account: %{id: id}}}, _params) do
	{:error, :not_found}
	end

	def follow(%{assigns: %{user: follower, account: followed}} = conn, _params) do
	with {:ok, follower} <- MastodonAPI.follow(follower, followed, conn.params) do
	render(conn, "relationship.json", user: follower, target: followed)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/unfollow"
	def unfollow(%{assigns: %{user: %{id: id}, account: %{id: id}}}, _params) do
	{:error, :not_found}
	end

	def unfollow(%{assigns: %{user: follower, account: followed}} = conn, _params) do
	with {:ok, follower} <- CommonAPI.unfollow(follower, followed) do
	render(conn, "relationship.json", user: follower, target: followed)
	end
	end

	@doc "POST /api/v1/accounts/:id/mute"
	def mute(%{assigns: %{user: muter, account: muted}} = conn, params) do
	notifications? = params \|> Map.get("notifications", true) \|> truthy_param?()

	with {:ok, _user_relationships} <- User.mute(muter, muted, notifications?) do
	render(conn, "relationship.json", user: muter, target: muted)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/unmute"
	def unmute(%{assigns: %{user: muter, account: muted}} = conn, _params) do
	with {:ok, _user_relationships} <- User.unmute(muter, muted) do
	render(conn, "relationship.json", user: muter, target: muted)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/block"
	def block(%{assigns: %{user: blocker, account: blocked}} = conn, _params) do
	with {:ok, _user_block} <- User.block(blocker, blocked),
	{:ok, _activity} <- ActivityPub.block(blocker, blocked) do
	render(conn, "relationship.json", user: blocker, target: blocked)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/accounts/:id/unblock"
	def unblock(%{assigns: %{user: blocker, account: blocked}} = conn, _params) do
	with {:ok, _user_block} <- User.unblock(blocker, blocked),
	{:ok, _activity} <- ActivityPub.unblock(blocker, blocked) do
	render(conn, "relationship.json", user: blocker, target: blocked)
	else
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "POST /api/v1/follows"
	def follows(%{assigns: %{user: follower}} = conn, %{"uri" => uri}) do
	with {_, %User{} = followed} <- {:followed, User.get_cached_by_nickname(uri)},
	{_, true} <- {:followed, follower.id != followed.id},
	{:ok, follower, followed, _} <- CommonAPI.follow(follower, followed) do
	render(conn, "show.json", user: followed, for: follower)
	else
	{:followed, _} -> {:error, :not_found}
	{:error, message} -> json_response(conn, :forbidden, %{error: message})
	end
	end

	@doc "GET /api/v1/mutes"
	def mutes(%{assigns: %{user: user}} = conn, _) do
	users = User.muted_users(user, _restrict_deactivated = true)
	render(conn, "index.json", users: users, for: user, as: :user)
	end

	@doc "GET /api/v1/blocks"
	def blocks(%{assigns: %{user: user}} = conn, _) do
	users = User.blocked_users(user, _restrict_deactivated = true)
	render(conn, "index.json", users: users, for: user, as: :user)
	end

	@doc "GET /api/v1/endorsements"
	- def endorsements(conn, params),
	- do: Pleroma.Web.MastodonAPI.MastodonAPIController.empty_array(conn, params)
	+ def endorsements(conn, params), do: MastodonAPIController.empty_array(conn, params)
	+
	+ @doc "GET /api/v1/identity_proofs"
	+ def identity_proofs(conn, params), do: MastodonAPIController.empty_array(conn, params)
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/mastodon_api_controller.ex b/lib/pleroma/web/mastodon_api/controllers/mastodon_api_controller.ex
	index 14075307de..ac8c18f242 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/mastodon_api_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/mastodon_api_controller.ex
	@@ -1,23 +1,33 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
	+ @moduledoc """
	+ Contains stubs for unimplemented Mastodon API endpoints.
	+
	+ Note: instead of routing directly to this controller's action,
	+ it's preferable to define an action in relevant (non-generic) controller,
	+ set up OAuth rules for it and call this controller's function from it.
	+ """
	+
	use Pleroma.Web, :controller

	require Logger

	+ plug(:skip_plug, Pleroma.Plugs.OAuthScopesPlug when action in [:empty_array, :empty_object])
	+
	+ plug(Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug)
	+
	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)

	- # Stubs for unimplemented mastodon api
	- #
	def empty_array(conn, _) do
	- Logger.debug("Unimplemented, returning an empty array")
	+ Logger.debug("Unimplemented, returning an empty array (list)")
	json(conn, [])
	end

	def empty_object(conn, _) do
	- Logger.debug("Unimplemented, returning an empty object")
	+ Logger.debug("Unimplemented, returning an empty object (map)")
	json(conn, %{})
	end
	end
	diff --git a/lib/pleroma/web/mastodon_api/controllers/suggestion_controller.ex b/lib/pleroma/web/mastodon_api/controllers/suggestion_controller.ex
	index 0cdc7bd8d9..c93a439696 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/suggestion_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/suggestion_controller.ex
	@@ -1,14 +1,17 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.SuggestionController do
	use Pleroma.Web, :controller

	+ alias Pleroma.Plugs.OAuthScopesPlug
	+
	require Logger

	+ plug(OAuthScopesPlug, %{scopes: ["read"]} when action == :index)
	+
	@doc "GET /api/v1/suggestions"
	- def index(conn, _) do
	- json(conn, [])
	- end
	+ def index(conn, params),
	+ do: Pleroma.Web.MastodonAPI.MastodonAPIController.empty_array(conn, params)
	end
	diff --git a/lib/pleroma/web/oauth/oauth_controller.ex b/lib/pleroma/web/oauth/oauth_controller.ex
	index 46688db7e8..0121cd6610 100644
	--- a/lib/pleroma/web/oauth/oauth_controller.ex
	+++ b/lib/pleroma/web/oauth/oauth_controller.ex
	@@ -1,532 +1,534 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.OAuth.OAuthController do
	use Pleroma.Web, :controller

	alias Pleroma.Helpers.UriHelper
	alias Pleroma.Plugs.RateLimiter
	alias Pleroma.Registration
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.Auth.Authenticator
	alias Pleroma.Web.ControllerHelper
	alias Pleroma.Web.OAuth.App
	alias Pleroma.Web.OAuth.Authorization
	alias Pleroma.Web.OAuth.Scopes
	alias Pleroma.Web.OAuth.Token
	alias Pleroma.Web.OAuth.Token.Strategy.RefreshToken
	alias Pleroma.Web.OAuth.Token.Strategy.Revoke, as: RevokeToken

	require Logger

	if Pleroma.Config.oauth_consumer_enabled?(), do: plug(Ueberauth)

	plug(:fetch_session)
	plug(:fetch_flash)
	plug(RateLimiter, [name: :authentication] when action == :create_authorization)

	+ plug(:skip_plug, Pleroma.Plugs.OAuthScopesPlug)
	+
	action_fallback(Pleroma.Web.OAuth.FallbackController)

	@oob_token_redirect_uri "urn:ietf:wg:oauth:2.0:oob"

	# Note: this definition is only called from error-handling methods with `conn.params` as 2nd arg
	def authorize(%Plug.Conn{} = conn, %{"authorization" => _} = params) do
	{auth_attrs, params} = Map.pop(params, "authorization")
	authorize(conn, Map.merge(params, auth_attrs))
	end

	def authorize(%Plug.Conn{assigns: %{token: %Token{}}} = conn, %{"force_login" => _} = params) do
	if ControllerHelper.truthy_param?(params["force_login"]) do
	do_authorize(conn, params)
	else
	handle_existing_authorization(conn, params)
	end
	end

	# Note: the token is set in oauth_plug, but the token and client do not always go together.
	# For example, MastodonFE's token is set if user requests with another client,
	# after user already authorized to MastodonFE.
	# So we have to check client and token.
	def authorize(
	%Plug.Conn{assigns: %{token: %Token{} = token}} = conn,
	%{"client_id" => client_id} = params
	) do
	with %Token{} = t <- Repo.get_by(Token, token: token.token) \|> Repo.preload(:app),
	^client_id <- t.app.client_id do
	handle_existing_authorization(conn, params)
	else
	_ -> do_authorize(conn, params)
	end
	end

	def authorize(%Plug.Conn{} = conn, params), do: do_authorize(conn, params)

	defp do_authorize(%Plug.Conn{} = conn, params) do
	app = Repo.get_by(App, client_id: params["client_id"])
	available_scopes = (app && app.scopes) \|\| []
	scopes = Scopes.fetch_scopes(params, available_scopes)

	# Note: `params` might differ from `conn.params`; use `@params` not `@conn.params` in template
	render(conn, Authenticator.auth_template(), %{
	response_type: params["response_type"],
	client_id: params["client_id"],
	available_scopes: available_scopes,
	scopes: scopes,
	redirect_uri: params["redirect_uri"],
	state: params["state"],
	params: params
	})
	end

	defp handle_existing_authorization(
	%Plug.Conn{assigns: %{token: %Token{} = token}} = conn,
	%{"redirect_uri" => @oob_token_redirect_uri}
	) do
	render(conn, "oob_token_exists.html", %{token: token})
	end

	defp handle_existing_authorization(
	%Plug.Conn{assigns: %{token: %Token{} = token}} = conn,
	%{} = params
	) do
	app = Repo.preload(token, :app).app

	redirect_uri =
	if is_binary(params["redirect_uri"]) do
	params["redirect_uri"]
	else
	default_redirect_uri(app)
	end

	if redirect_uri in String.split(app.redirect_uris) do
	redirect_uri = redirect_uri(conn, redirect_uri)
	url_params = %{access_token: token.token}
	url_params = UriHelper.append_param_if_present(url_params, :state, params["state"])
	url = UriHelper.append_uri_params(redirect_uri, url_params)
	redirect(conn, external: url)
	else
	conn
	\|> put_flash(:error, dgettext("errors", "Unlisted redirect_uri."))
	\|> redirect(external: redirect_uri(conn, redirect_uri))
	end
	end

	def create_authorization(
	%Plug.Conn{} = conn,
	%{"authorization" => _} = params,
	opts \\ []
	) do
	with {:ok, auth} <- do_create_authorization(conn, params, opts[:user]) do
	after_create_authorization(conn, auth, params)
	else
	error ->
	handle_create_authorization_error(conn, error, params)
	end
	end

	def after_create_authorization(%Plug.Conn{} = conn, %Authorization{} = auth, %{
	"authorization" => %{"redirect_uri" => @oob_token_redirect_uri}
	}) do
	render(conn, "oob_authorization_created.html", %{auth: auth})
	end

	def after_create_authorization(%Plug.Conn{} = conn, %Authorization{} = auth, %{
	"authorization" => %{"redirect_uri" => redirect_uri} = auth_attrs
	}) do
	app = Repo.preload(auth, :app).app

	# An extra safety measure before we redirect (also done in `do_create_authorization/2`)
	if redirect_uri in String.split(app.redirect_uris) do
	redirect_uri = redirect_uri(conn, redirect_uri)
	url_params = %{code: auth.token}
	url_params = UriHelper.append_param_if_present(url_params, :state, auth_attrs["state"])
	url = UriHelper.append_uri_params(redirect_uri, url_params)
	redirect(conn, external: url)
	else
	conn
	\|> put_flash(:error, dgettext("errors", "Unlisted redirect_uri."))
	\|> redirect(external: redirect_uri(conn, redirect_uri))
	end
	end

	defp handle_create_authorization_error(
	%Plug.Conn{} = conn,
	{:error, scopes_issue},
	%{"authorization" => _} = params
	)
	when scopes_issue in [:unsupported_scopes, :missing_scopes] do
	# Per https://github.com/tootsuite/mastodon/blob/
	# 51e154f5e87968d6bb115e053689767ab33e80cd/app/controllers/api/base_controller.rb#L39
	conn
	\|> put_flash(:error, dgettext("errors", "This action is outside the authorized scopes"))
	\|> put_status(:unauthorized)
	\|> authorize(params)
	end

	defp handle_create_authorization_error(
	%Plug.Conn{} = conn,
	{:account_status, :confirmation_pending},
	%{"authorization" => _} = params
	) do
	conn
	\|> put_flash(:error, dgettext("errors", "Your login is missing a confirmed e-mail address"))
	\|> put_status(:forbidden)
	\|> authorize(params)
	end

	defp handle_create_authorization_error(
	%Plug.Conn{} = conn,
	{:account_status, :password_reset_pending},
	%{"authorization" => _} = params
	) do
	conn
	\|> put_flash(:error, dgettext("errors", "Password reset is required"))
	\|> put_status(:forbidden)
	\|> authorize(params)
	end

	defp handle_create_authorization_error(
	%Plug.Conn{} = conn,
	{:account_status, :deactivated},
	%{"authorization" => _} = params
	) do
	conn
	\|> put_flash(:error, dgettext("errors", "Your account is currently disabled"))
	\|> put_status(:forbidden)
	\|> authorize(params)
	end

	defp handle_create_authorization_error(%Plug.Conn{} = conn, error, %{"authorization" => _}) do
	Authenticator.handle_error(conn, error)
	end

	@doc "Renew access_token with refresh_token"
	def token_exchange(
	%Plug.Conn{} = conn,
	%{"grant_type" => "refresh_token", "refresh_token" => token} = _params
	) do
	with {:ok, app} <- Token.Utils.fetch_app(conn),
	{:ok, %{user: user} = token} <- Token.get_by_refresh_token(app, token),
	{:ok, token} <- RefreshToken.grant(token) do
	response_attrs = %{created_at: Token.Utils.format_created_at(token)}

	json(conn, Token.Response.build(user, token, response_attrs))
	else
	_error -> render_invalid_credentials_error(conn)
	end
	end

	def token_exchange(%Plug.Conn{} = conn, %{"grant_type" => "authorization_code"} = params) do
	with {:ok, app} <- Token.Utils.fetch_app(conn),
	fixed_token = Token.Utils.fix_padding(params["code"]),
	{:ok, auth} <- Authorization.get_by_token(app, fixed_token),
	%User{} = user <- User.get_cached_by_id(auth.user_id),
	{:ok, token} <- Token.exchange_token(app, auth) do
	response_attrs = %{created_at: Token.Utils.format_created_at(token)}

	json(conn, Token.Response.build(user, token, response_attrs))
	else
	_error -> render_invalid_credentials_error(conn)
	end
	end

	def token_exchange(
	%Plug.Conn{} = conn,
	%{"grant_type" => "password"} = params
	) do
	with {:ok, %User{} = user} <- Authenticator.get_user(conn),
	{:ok, app} <- Token.Utils.fetch_app(conn),
	{:account_status, :active} <- {:account_status, User.account_status(user)},
	{:ok, scopes} <- validate_scopes(app, params),
	{:ok, auth} <- Authorization.create_authorization(app, user, scopes),
	{:ok, token} <- Token.exchange_token(app, auth) do
	json(conn, Token.Response.build(user, token))
	else
	error ->
	handle_token_exchange_error(conn, error)
	end
	end

	def token_exchange(
	%Plug.Conn{} = conn,
	%{"grant_type" => "password", "name" => name, "password" => _password} = params
	) do
	params =
	params
	\|> Map.delete("name")
	\|> Map.put("username", name)

	token_exchange(conn, params)
	end

	def token_exchange(%Plug.Conn{} = conn, %{"grant_type" => "client_credentials"} = _params) do
	with {:ok, app} <- Token.Utils.fetch_app(conn),
	{:ok, auth} <- Authorization.create_authorization(app, %User{}),
	{:ok, token} <- Token.exchange_token(app, auth) do
	json(conn, Token.Response.build_for_client_credentials(token))
	else
	_error -> render_invalid_credentials_error(conn)
	end
	end

	# Bad request
	def token_exchange(%Plug.Conn{} = conn, params), do: bad_request(conn, params)

	defp handle_token_exchange_error(%Plug.Conn{} = conn, {:account_status, :deactivated}) do
	render_error(
	conn,
	:forbidden,
	"Your account is currently disabled",
	%{},
	"account_is_disabled"
	)
	end

	defp handle_token_exchange_error(
	%Plug.Conn{} = conn,
	{:account_status, :password_reset_pending}
	) do
	render_error(
	conn,
	:forbidden,
	"Password reset is required",
	%{},
	"password_reset_required"
	)
	end

	defp handle_token_exchange_error(%Plug.Conn{} = conn, {:account_status, :confirmation_pending}) do
	render_error(
	conn,
	:forbidden,
	"Your login is missing a confirmed e-mail address",
	%{},
	"missing_confirmed_email"
	)
	end

	defp handle_token_exchange_error(%Plug.Conn{} = conn, _error) do
	render_invalid_credentials_error(conn)
	end

	def token_revoke(%Plug.Conn{} = conn, %{"token" => _token} = params) do
	with {:ok, app} <- Token.Utils.fetch_app(conn),
	{:ok, _token} <- RevokeToken.revoke(app, params) do
	json(conn, %{})
	else
	_error ->
	# RFC 7009: invalid tokens [in the request] do not cause an error response
	json(conn, %{})
	end
	end

	def token_revoke(%Plug.Conn{} = conn, params), do: bad_request(conn, params)

	# Response for bad request
	defp bad_request(%Plug.Conn{} = conn, _) do
	render_error(conn, :internal_server_error, "Bad request")
	end

	@doc "Prepares OAuth request to provider for Ueberauth"
	def prepare_request(%Plug.Conn{} = conn, %{
	"provider" => provider,
	"authorization" => auth_attrs
	}) do
	scope =
	auth_attrs
	\|> Scopes.fetch_scopes([])
	\|> Scopes.to_string()

	state =
	auth_attrs
	\|> Map.delete("scopes")
	\|> Map.put("scope", scope)
	\|> Jason.encode!()

	params =
	auth_attrs
	\|> Map.drop(~w(scope scopes client_id redirect_uri))
	\|> Map.put("state", state)

	# Handing the request to Ueberauth
	redirect(conn, to: o_auth_path(conn, :request, provider, params))
	end

	def request(%Plug.Conn{} = conn, params) do
	message =
	if params["provider"] do
	dgettext("errors", "Unsupported OAuth provider: %{provider}.",
	provider: params["provider"]
	)
	else
	dgettext("errors", "Bad OAuth request.")
	end

	conn
	\|> put_flash(:error, message)
	\|> redirect(to: "/")
	end

	def callback(%Plug.Conn{assigns: %{ueberauth_failure: failure}} = conn, params) do
	params = callback_params(params)
	messages = for e <- Map.get(failure, :errors, []), do: e.message
	message = Enum.join(messages, "; ")

	conn
	\|> put_flash(
	:error,
	dgettext("errors", "Failed to authenticate: %{message}.", message: message)
	)
	\|> redirect(external: redirect_uri(conn, params["redirect_uri"]))
	end

	def callback(%Plug.Conn{} = conn, params) do
	params = callback_params(params)

	with {:ok, registration} <- Authenticator.get_registration(conn) do
	auth_attrs = Map.take(params, ~w(client_id redirect_uri scope scopes state))

	case Repo.get_assoc(registration, :user) do
	{:ok, user} ->
	create_authorization(conn, %{"authorization" => auth_attrs}, user: user)

	_ ->
	registration_params =
	Map.merge(auth_attrs, %{
	"nickname" => Registration.nickname(registration),
	"email" => Registration.email(registration)
	})

	conn
	\|> put_session_registration_id(registration.id)
	\|> registration_details(%{"authorization" => registration_params})
	end
	else
	error ->
	Logger.debug(inspect(["OAUTH_ERROR", error, conn.assigns]))

	conn
	\|> put_flash(:error, dgettext("errors", "Failed to set up user account."))
	\|> redirect(external: redirect_uri(conn, params["redirect_uri"]))
	end
	end

	defp callback_params(%{"state" => state} = params) do
	Map.merge(params, Jason.decode!(state))
	end

	def registration_details(%Plug.Conn{} = conn, %{"authorization" => auth_attrs}) do
	render(conn, "register.html", %{
	client_id: auth_attrs["client_id"],
	redirect_uri: auth_attrs["redirect_uri"],
	state: auth_attrs["state"],
	scopes: Scopes.fetch_scopes(auth_attrs, []),
	nickname: auth_attrs["nickname"],
	email: auth_attrs["email"]
	})
	end

	def register(%Plug.Conn{} = conn, %{"authorization" => _, "op" => "connect"} = params) do
	with registration_id when not is_nil(registration_id) <- get_session_registration_id(conn),
	%Registration{} = registration <- Repo.get(Registration, registration_id),
	{_, {:ok, auth}} <- {:create_authorization, do_create_authorization(conn, params)},
	%User{} = user <- Repo.preload(auth, :user).user,
	{:ok, _updated_registration} <- Registration.bind_to_user(registration, user) do
	conn
	\|> put_session_registration_id(nil)
	\|> after_create_authorization(auth, params)
	else
	{:create_authorization, error} ->
	{:register, handle_create_authorization_error(conn, error, params)}

	_ ->
	{:register, :generic_error}
	end
	end

	def register(%Plug.Conn{} = conn, %{"authorization" => _, "op" => "register"} = params) do
	with registration_id when not is_nil(registration_id) <- get_session_registration_id(conn),
	%Registration{} = registration <- Repo.get(Registration, registration_id),
	{:ok, user} <- Authenticator.create_from_registration(conn, registration) do
	conn
	\|> put_session_registration_id(nil)
	\|> create_authorization(
	params,
	user: user
	)
	else
	{:error, changeset} ->
	message =
	Enum.map(changeset.errors, fn {field, {error, _}} ->
	"#{field} #{error}"
	end)
	\|> Enum.join("; ")

	message =
	String.replace(
	message,
	"ap_id has already been taken",
	"nickname has already been taken"
	)

	conn
	\|> put_status(:forbidden)
	\|> put_flash(:error, "Error: #{message}.")
	\|> registration_details(params)

	_ ->
	{:register, :generic_error}
	end
	end

	defp do_create_authorization(
	%Plug.Conn{} = conn,
	%{
	"authorization" =>
	%{
	"client_id" => client_id,
	"redirect_uri" => redirect_uri
	} = auth_attrs
	},
	user \\ nil
	) do
	with {_, {:ok, %User{} = user}} <-
	{:get_user, (user && {:ok, user}) \|\| Authenticator.get_user(conn)},
	%App{} = app <- Repo.get_by(App, client_id: client_id),
	true <- redirect_uri in String.split(app.redirect_uris),
	{:ok, scopes} <- validate_scopes(app, auth_attrs),
	{:account_status, :active} <- {:account_status, User.account_status(user)} do
	Authorization.create_authorization(app, user, scopes)
	end
	end

	# Special case: Local MastodonFE
	defp redirect_uri(%Plug.Conn{} = conn, "."), do: auth_url(conn, :login)

	defp redirect_uri(%Plug.Conn{}, redirect_uri), do: redirect_uri

	defp get_session_registration_id(%Plug.Conn{} = conn), do: get_session(conn, :registration_id)

	defp put_session_registration_id(%Plug.Conn{} = conn, registration_id),
	do: put_session(conn, :registration_id, registration_id)

	@spec validate_scopes(App.t(), map()) ::
	{:ok, list()} \| {:error, :missing_scopes \| :unsupported_scopes}
	defp validate_scopes(%App{} = app, params) do
	params
	\|> Scopes.fetch_scopes(app.scopes)
	\|> Scopes.validate(app.scopes)
	end

	def default_redirect_uri(%App{} = app) do
	app.redirect_uris
	\|> String.split()
	\|> Enum.at(0)
	end

	defp render_invalid_credentials_error(conn) do
	render_error(conn, :bad_request, "Invalid credentials")
	end
	end
	diff --git a/lib/pleroma/web/pleroma_api/controllers/pleroma_api_controller.ex b/lib/pleroma/web/pleroma_api/controllers/pleroma_api_controller.ex
	index dae7f0f2f7..75f61b675a 100644
	--- a/lib/pleroma/web/pleroma_api/controllers/pleroma_api_controller.ex
	+++ b/lib/pleroma/web/pleroma_api/controllers/pleroma_api_controller.ex
	@@ -1,196 +1,196 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.PleromaAPI.PleromaAPIController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper, only: [add_link_headers: 2]

	alias Pleroma.Activity
	alias Pleroma.Conversation.Participation
	alias Pleroma.Notification
	alias Pleroma.Object
	alias Pleroma.Plugs.OAuthScopesPlug
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.MastodonAPI.AccountView
	alias Pleroma.Web.MastodonAPI.ConversationView
	alias Pleroma.Web.MastodonAPI.NotificationView
	alias Pleroma.Web.MastodonAPI.StatusView

	plug(
	OAuthScopesPlug,
	%{scopes: ["read:statuses"]}
	when action in [:conversation, :conversation_statuses]
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["write:statuses"]}
	when action in [:react_with_emoji, :unreact_with_emoji]
	)

	plug(
	OAuthScopesPlug,
	- %{scopes: ["write:conversations"]} when action == :update_conversation
	+ %{scopes: ["write:conversations"]} when action in [:update_conversation, :read_conversations]
	)

	plug(OAuthScopesPlug, %{scopes: ["write:notifications"]} when action == :read_notification)

	plug(Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug)

	def emoji_reactions_by(%{assigns: %{user: user}} = conn, %{"id" => activity_id} = params) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(activity_id),
	%Object{data: %{"reactions" => emoji_reactions}} when is_list(emoji_reactions) <-
	Object.normalize(activity) do
	reactions =
	emoji_reactions
	\|> Enum.map(fn [emoji, user_ap_ids] ->
	if params["emoji"] && params["emoji"] != emoji do
	nil
	else
	users =
	Enum.map(user_ap_ids, &User.get_cached_by_ap_id/1)
	\|> Enum.filter(& &1)

	%{
	name: emoji,
	count: length(users),
	accounts: AccountView.render("index.json", %{users: users, for: user, as: :user}),
	me: !!(user && user.ap_id in user_ap_ids)
	}
	end
	end)
	\|> Enum.filter(& &1)

	conn
	\|> json(reactions)
	else
	_e ->
	conn
	\|> json([])
	end
	end

	def react_with_emoji(%{assigns: %{user: user}} = conn, %{"id" => activity_id, "emoji" => emoji}) do
	with {:ok, _activity, _object} <- CommonAPI.react_with_emoji(activity_id, user, emoji),
	activity <- Activity.get_by_id(activity_id) do
	conn
	\|> put_view(StatusView)
	\|> render("show.json", %{activity: activity, for: user, as: :activity})
	end
	end

	def unreact_with_emoji(%{assigns: %{user: user}} = conn, %{
	"id" => activity_id,
	"emoji" => emoji
	}) do
	with {:ok, _activity, _object} <- CommonAPI.unreact_with_emoji(activity_id, user, emoji),
	activity <- Activity.get_by_id(activity_id) do
	conn
	\|> put_view(StatusView)
	\|> render("show.json", %{activity: activity, for: user, as: :activity})
	end
	end

	def conversation(%{assigns: %{user: user}} = conn, %{"id" => participation_id}) do
	with %Participation{} = participation <- Participation.get(participation_id),
	true <- user.id == participation.user_id do
	conn
	\|> put_view(ConversationView)
	\|> render("participation.json", %{participation: participation, for: user})
	else
	_error ->
	conn
	\|> put_status(404)
	\|> json(%{"error" => "Unknown conversation id"})
	end
	end

	def conversation_statuses(
	%{assigns: %{user: user}} = conn,
	%{"id" => participation_id} = params
	) do
	with %Participation{} = participation <-
	Participation.get(participation_id, preload: [:conversation]),
	true <- user.id == participation.user_id do
	params =
	params
	\|> Map.put("blocking_user", user)
	\|> Map.put("muting_user", user)
	\|> Map.put("user", user)

	activities =
	participation.conversation.ap_id
	\|> ActivityPub.fetch_activities_for_context(params)
	\|> Enum.reverse()

	conn
	\|> add_link_headers(activities)
	\|> put_view(StatusView)
	\|> render("index.json", %{activities: activities, for: user, as: :activity})
	else
	_error ->
	conn
	\|> put_status(404)
	\|> json(%{"error" => "Unknown conversation id"})
	end
	end

	def update_conversation(
	%{assigns: %{user: user}} = conn,
	%{"id" => participation_id, "recipients" => recipients}
	) do
	with %Participation{} = participation <- Participation.get(participation_id),
	true <- user.id == participation.user_id,
	{:ok, participation} <- Participation.set_recipients(participation, recipients) do
	conn
	\|> put_view(ConversationView)
	\|> render("participation.json", %{participation: participation, for: user})
	else
	{:error, message} ->
	conn
	\|> put_status(:bad_request)
	\|> json(%{"error" => message})

	_error ->
	conn
	\|> put_status(404)
	\|> json(%{"error" => "Unknown conversation id"})
	end
	end

	def read_conversations(%{assigns: %{user: user}} = conn, _params) do
	with {:ok, _, participations} <- Participation.mark_all_as_read(user) do
	conn
	\|> add_link_headers(participations)
	\|> put_view(ConversationView)
	\|> render("participations.json", participations: participations, for: user)
	end
	end

	def read_notification(%{assigns: %{user: user}} = conn, %{"id" => notification_id}) do
	with {:ok, notification} <- Notification.read_one(user, notification_id) do
	conn
	\|> put_view(NotificationView)
	\|> render("show.json", %{notification: notification, for: user})
	else
	{:error, message} ->
	conn
	\|> put_status(:bad_request)
	\|> json(%{"error" => message})
	end
	end

	def read_notification(%{assigns: %{user: user}} = conn, %{"max_id" => max_id}) do
	with notifications <- Notification.set_read_up_to(user, max_id) do
	notifications = Enum.take(notifications, 80)

	conn
	\|> put_view(NotificationView)
	\|> render("index.json", %{notifications: notifications, for: user})
	end
	end
	end
	diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex
	index 5a09027391..3d57073d0f 100644
	--- a/lib/pleroma/web/router.ex
	+++ b/lib/pleroma/web/router.ex
	@@ -1,674 +1,675 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Router do
	use Pleroma.Web, :router

	pipeline :browser do
	plug(:accepts, ["html"])
	plug(:fetch_session)
	end

	pipeline :oauth do
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	end

	pipeline :api do
	plug(:accepts, ["json"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureUserKeyPlug)
	plug(Pleroma.Plugs.IdempotencyPlug)
	end

	pipeline :authenticated_api do
	plug(:accepts, ["json"])
	plug(:fetch_session)
	+ plug(Pleroma.Plugs.AuthExpectedPlug)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureAuthenticatedPlug)
	plug(Pleroma.Plugs.IdempotencyPlug)
	end

	pipeline :admin_api do
	plug(:accepts, ["json"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.AdminSecretAuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureAuthenticatedPlug)
	plug(Pleroma.Plugs.UserIsAdminPlug)
	plug(Pleroma.Plugs.IdempotencyPlug)
	end

	pipeline :mastodon_html do
	plug(:accepts, ["html"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureUserKeyPlug)
	end

	pipeline :pleroma_html do
	plug(:accepts, ["html"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.EnsureUserKeyPlug)
	end

	pipeline :well_known do
	plug(:accepts, ["json", "jrd+json", "xml", "xrd+xml"])
	end

	pipeline :config do
	plug(:accepts, ["json", "xml"])
	end

	pipeline :pleroma_api do
	plug(:accepts, ["html", "json"])
	end

	pipeline :mailbox_preview do
	plug(:accepts, ["html"])

	plug(:put_secure_browser_headers, %{
	"content-security-policy" =>
	"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' 'unsafe-eval'"
	})
	end

	pipeline :http_signature do
	plug(Pleroma.Web.Plugs.HTTPSignaturePlug)
	plug(Pleroma.Web.Plugs.MappedSignatureToIdentityPlug)
	end

	scope "/api/pleroma", Pleroma.Web.TwitterAPI do
	pipe_through(:pleroma_api)

	get("/password_reset/:token", PasswordController, :reset, as: :reset_password)
	post("/password_reset", PasswordController, :do_reset, as: :reset_password)
	get("/emoji", UtilController, :emoji)
	get("/captcha", UtilController, :captcha)
	get("/healthcheck", UtilController, :healthcheck)
	end

	scope "/api/pleroma", Pleroma.Web do
	pipe_through(:pleroma_api)
	post("/uploader_callback/:upload_path", UploaderController, :callback)
	end

	scope "/api/pleroma/admin", Pleroma.Web.AdminAPI do
	pipe_through(:admin_api)

	post("/users/follow", AdminAPIController, :user_follow)
	post("/users/unfollow", AdminAPIController, :user_unfollow)

	delete("/users", AdminAPIController, :user_delete)
	post("/users", AdminAPIController, :users_create)
	patch("/users/:nickname/toggle_activation", AdminAPIController, :user_toggle_activation)
	patch("/users/activate", AdminAPIController, :user_activate)
	patch("/users/deactivate", AdminAPIController, :user_deactivate)
	put("/users/tag", AdminAPIController, :tag_users)
	delete("/users/tag", AdminAPIController, :untag_users)

	get("/users/:nickname/permission_group", AdminAPIController, :right_get)
	get("/users/:nickname/permission_group/:permission_group", AdminAPIController, :right_get)

	post("/users/:nickname/permission_group/:permission_group", AdminAPIController, :right_add)

	delete(
	"/users/:nickname/permission_group/:permission_group",
	AdminAPIController,
	:right_delete
	)

	post("/users/permission_group/:permission_group", AdminAPIController, :right_add_multiple)

	delete(
	"/users/permission_group/:permission_group",
	AdminAPIController,
	:right_delete_multiple
	)

	get("/relay", AdminAPIController, :relay_list)
	post("/relay", AdminAPIController, :relay_follow)
	delete("/relay", AdminAPIController, :relay_unfollow)

	post("/users/invite_token", AdminAPIController, :create_invite_token)
	get("/users/invites", AdminAPIController, :invites)
	post("/users/revoke_invite", AdminAPIController, :revoke_invite)
	post("/users/email_invite", AdminAPIController, :email_invite)

	get("/users/:nickname/password_reset", AdminAPIController, :get_password_reset)
	patch("/users/force_password_reset", AdminAPIController, :force_password_reset)
	get("/users/:nickname/credentials", AdminAPIController, :show_user_credentials)
	patch("/users/:nickname/credentials", AdminAPIController, :update_user_credentials)

	get("/users", AdminAPIController, :list_users)
	get("/users/:nickname", AdminAPIController, :user_show)
	get("/users/:nickname/statuses", AdminAPIController, :list_user_statuses)

	get("/instances/:instance/statuses", AdminAPIController, :list_instance_statuses)

	patch("/users/confirm_email", AdminAPIController, :confirm_email)
	patch("/users/resend_confirmation_email", AdminAPIController, :resend_confirmation_email)

	get("/reports", AdminAPIController, :list_reports)
	get("/reports/:id", AdminAPIController, :report_show)
	patch("/reports", AdminAPIController, :reports_update)
	post("/reports/:id/notes", AdminAPIController, :report_notes_create)
	delete("/reports/:report_id/notes/:id", AdminAPIController, :report_notes_delete)

	put("/statuses/:id", AdminAPIController, :status_update)
	delete("/statuses/:id", AdminAPIController, :status_delete)
	get("/statuses", AdminAPIController, :list_statuses)

	get("/config", AdminAPIController, :config_show)
	post("/config", AdminAPIController, :config_update)
	get("/config/descriptions", AdminAPIController, :config_descriptions)
	get("/restart", AdminAPIController, :restart)

	get("/moderation_log", AdminAPIController, :list_log)

	post("/reload_emoji", AdminAPIController, :reload_emoji)
	get("/stats", AdminAPIController, :stats)
	end

	scope "/api/pleroma/emoji", Pleroma.Web.PleromaAPI do
	scope "/packs" do
	# Modifying packs
	pipe_through(:admin_api)

	post("/import_from_fs", EmojiAPIController, :import_from_fs)

	post("/:pack_name/update_file", EmojiAPIController, :update_file)
	post("/:pack_name/update_metadata", EmojiAPIController, :update_metadata)
	put("/:name", EmojiAPIController, :create)
	delete("/:name", EmojiAPIController, :delete)
	post("/download_from", EmojiAPIController, :download_from)
	post("/list_from", EmojiAPIController, :list_from)
	end

	scope "/packs" do
	# Pack info / downloading
	get("/", EmojiAPIController, :list_packs)
	get("/:name/download_shared/", EmojiAPIController, :download_shared)
	end
	end

	scope "/", Pleroma.Web.TwitterAPI do
	pipe_through(:pleroma_html)

	post("/main/ostatus", UtilController, :remote_subscribe)
	get("/ostatus_subscribe", RemoteFollowController, :follow)

	post("/ostatus_subscribe", RemoteFollowController, :do_follow)
	end

	scope "/api/pleroma", Pleroma.Web.TwitterAPI do
	pipe_through(:authenticated_api)

	post("/change_email", UtilController, :change_email)
	post("/change_password", UtilController, :change_password)
	post("/delete_account", UtilController, :delete_account)
	put("/notification_settings", UtilController, :update_notificaton_settings)
	post("/disable_account", UtilController, :disable_account)

	post("/blocks_import", UtilController, :blocks_import)
	post("/follow_import", UtilController, :follow_import)
	end

	scope "/oauth", Pleroma.Web.OAuth do
	scope [] do
	pipe_through(:oauth)
	get("/authorize", OAuthController, :authorize)
	end

	post("/authorize", OAuthController, :create_authorization)
	post("/token", OAuthController, :token_exchange)
	post("/revoke", OAuthController, :token_revoke)
	get("/registration_details", OAuthController, :registration_details)

	scope [] do
	pipe_through(:browser)

	get("/prepare_request", OAuthController, :prepare_request)
	get("/:provider", OAuthController, :request)
	get("/:provider/callback", OAuthController, :callback)
	post("/register", OAuthController, :register)
	end
	end

	scope "/api/v1/pleroma", Pleroma.Web.PleromaAPI do
	pipe_through(:api)

	get("/statuses/:id/reactions/:emoji", PleromaAPIController, :emoji_reactions_by)
	get("/statuses/:id/reactions", PleromaAPIController, :emoji_reactions_by)
	end

	scope "/api/v1/pleroma", Pleroma.Web.PleromaAPI do
	scope [] do
	pipe_through(:authenticated_api)

	get("/conversations/:id/statuses", PleromaAPIController, :conversation_statuses)
	get("/conversations/:id", PleromaAPIController, :conversation)
	post("/conversations/read", PleromaAPIController, :read_conversations)
	end

	scope [] do
	pipe_through(:authenticated_api)

	patch("/conversations/:id", PleromaAPIController, :update_conversation)
	put("/statuses/:id/reactions/:emoji", PleromaAPIController, :react_with_emoji)
	delete("/statuses/:id/reactions/:emoji", PleromaAPIController, :unreact_with_emoji)
	post("/notifications/read", PleromaAPIController, :read_notification)

	patch("/accounts/update_avatar", AccountController, :update_avatar)
	patch("/accounts/update_banner", AccountController, :update_banner)
	patch("/accounts/update_background", AccountController, :update_background)

	get("/mascot", MascotController, :show)
	put("/mascot", MascotController, :update)

	post("/scrobble", ScrobbleController, :new_scrobble)
	end

	scope [] do
	pipe_through(:api)
	get("/accounts/:id/favourites", AccountController, :favourites)
	end

	scope [] do
	pipe_through(:authenticated_api)

	post("/accounts/:id/subscribe", AccountController, :subscribe)
	post("/accounts/:id/unsubscribe", AccountController, :unsubscribe)
	end

	post("/accounts/confirmation_resend", AccountController, :confirmation_resend)
	end

	scope "/api/v1/pleroma", Pleroma.Web.PleromaAPI do
	pipe_through(:api)
	get("/accounts/:id/scrobbles", ScrobbleController, :user_scrobbles)
	end

	scope "/api/v1", Pleroma.Web.MastodonAPI do
	pipe_through(:authenticated_api)

	get("/accounts/verify_credentials", AccountController, :verify_credentials)

	get("/accounts/relationships", AccountController, :relationships)

	get("/accounts/:id/lists", AccountController, :lists)
	- get("/accounts/:id/identity_proofs", MastodonAPIController, :empty_array)
	+ get("/accounts/:id/identity_proofs", AccountController, :identity_proofs)

	get("/follow_requests", FollowRequestController, :index)
	get("/blocks", AccountController, :blocks)
	get("/mutes", AccountController, :mutes)

	get("/timelines/home", TimelineController, :home)
	get("/timelines/direct", TimelineController, :direct)

	get("/favourites", StatusController, :favourites)
	get("/bookmarks", StatusController, :bookmarks)

	get("/notifications", NotificationController, :index)
	get("/notifications/:id", NotificationController, :show)
	post("/notifications/clear", NotificationController, :clear)
	post("/notifications/dismiss", NotificationController, :dismiss)
	delete("/notifications/destroy_multiple", NotificationController, :destroy_multiple)

	get("/scheduled_statuses", ScheduledActivityController, :index)
	get("/scheduled_statuses/:id", ScheduledActivityController, :show)

	get("/lists", ListController, :index)
	get("/lists/:id", ListController, :show)
	get("/lists/:id/accounts", ListController, :list_accounts)

	get("/domain_blocks", DomainBlockController, :index)

	get("/filters", FilterController, :index)

	get("/suggestions", SuggestionController, :index)

	get("/conversations", ConversationController, :index)
	post("/conversations/:id/read", ConversationController, :read)

	get("/endorsements", AccountController, :endorsements)

	patch("/accounts/update_credentials", AccountController, :update_credentials)

	post("/statuses", StatusController, :create)
	delete("/statuses/:id", StatusController, :delete)

	post("/statuses/:id/reblog", StatusController, :reblog)
	post("/statuses/:id/unreblog", StatusController, :unreblog)
	post("/statuses/:id/favourite", StatusController, :favourite)
	post("/statuses/:id/unfavourite", StatusController, :unfavourite)
	post("/statuses/:id/pin", StatusController, :pin)
	post("/statuses/:id/unpin", StatusController, :unpin)
	post("/statuses/:id/bookmark", StatusController, :bookmark)
	post("/statuses/:id/unbookmark", StatusController, :unbookmark)
	post("/statuses/:id/mute", StatusController, :mute_conversation)
	post("/statuses/:id/unmute", StatusController, :unmute_conversation)

	put("/scheduled_statuses/:id", ScheduledActivityController, :update)
	delete("/scheduled_statuses/:id", ScheduledActivityController, :delete)

	post("/polls/:id/votes", PollController, :vote)

	post("/media", MediaController, :create)
	put("/media/:id", MediaController, :update)

	delete("/lists/:id", ListController, :delete)
	post("/lists", ListController, :create)
	put("/lists/:id", ListController, :update)

	post("/lists/:id/accounts", ListController, :add_to_list)
	delete("/lists/:id/accounts", ListController, :remove_from_list)

	post("/filters", FilterController, :create)
	get("/filters/:id", FilterController, :show)
	put("/filters/:id", FilterController, :update)
	delete("/filters/:id", FilterController, :delete)

	post("/reports", ReportController, :create)

	post("/follows", AccountController, :follows)
	post("/accounts/:id/follow", AccountController, :follow)
	post("/accounts/:id/unfollow", AccountController, :unfollow)
	post("/accounts/:id/block", AccountController, :block)
	post("/accounts/:id/unblock", AccountController, :unblock)
	post("/accounts/:id/mute", AccountController, :mute)
	post("/accounts/:id/unmute", AccountController, :unmute)

	post("/follow_requests/:id/authorize", FollowRequestController, :authorize)
	post("/follow_requests/:id/reject", FollowRequestController, :reject)

	post("/domain_blocks", DomainBlockController, :create)
	delete("/domain_blocks", DomainBlockController, :delete)

	post("/push/subscription", SubscriptionController, :create)
	get("/push/subscription", SubscriptionController, :get)
	put("/push/subscription", SubscriptionController, :update)
	delete("/push/subscription", SubscriptionController, :delete)

	get("/markers", MarkerController, :index)
	post("/markers", MarkerController, :upsert)
	end

	scope "/api/web", Pleroma.Web do
	pipe_through(:authenticated_api)

	put("/settings", MastoFEController, :put_settings)
	end

	scope "/api/v1", Pleroma.Web.MastodonAPI do
	pipe_through(:api)

	post("/accounts", AccountController, :create)
	get("/accounts/search", SearchController, :account_search)

	get("/instance", InstanceController, :show)
	get("/instance/peers", InstanceController, :peers)

	post("/apps", AppController, :create)
	get("/apps/verify_credentials", AppController, :verify_credentials)

	get("/statuses/:id/card", StatusController, :card)
	get("/statuses/:id/favourited_by", StatusController, :favourited_by)
	get("/statuses/:id/reblogged_by", StatusController, :reblogged_by)

	get("/custom_emojis", CustomEmojiController, :index)

	get("/trends", MastodonAPIController, :empty_array)

	get("/timelines/public", TimelineController, :public)
	get("/timelines/tag/:tag", TimelineController, :hashtag)
	get("/timelines/list/:list_id", TimelineController, :list)

	get("/statuses", StatusController, :index)
	get("/statuses/:id", StatusController, :show)
	get("/statuses/:id/context", StatusController, :context)

	get("/polls/:id", PollController, :show)

	get("/accounts/:id/statuses", AccountController, :statuses)
	get("/accounts/:id/followers", AccountController, :followers)
	get("/accounts/:id/following", AccountController, :following)
	get("/accounts/:id", AccountController, :show)

	get("/search", SearchController, :search)
	end

	scope "/api/v2", Pleroma.Web.MastodonAPI do
	pipe_through(:api)
	get("/search", SearchController, :search2)
	end

	scope "/api", Pleroma.Web do
	pipe_through(:config)

	get("/help/test", TwitterAPI.UtilController, :help_test)
	post("/help/test", TwitterAPI.UtilController, :help_test)
	get("/statusnet/config", TwitterAPI.UtilController, :config)
	get("/statusnet/version", TwitterAPI.UtilController, :version)
	get("/pleroma/frontend_configurations", TwitterAPI.UtilController, :frontend_configurations)
	end

	scope "/api", Pleroma.Web do
	pipe_through(:api)

	get(
	"/account/confirm_email/:user_id/:token",
	TwitterAPI.Controller,
	:confirm_email,
	as: :confirm_email
	)
	end

	scope "/api", Pleroma.Web, as: :authenticated_twitter_api do
	pipe_through(:authenticated_api)

	get("/oauth_tokens", TwitterAPI.Controller, :oauth_tokens)
	delete("/oauth_tokens/:id", TwitterAPI.Controller, :revoke_token)

	post("/qvitter/statuses/notifications/read", TwitterAPI.Controller, :notifications_read)
	end

	pipeline :ap_service_actor do
	plug(:accepts, ["activity+json", "json"])
	end

	pipeline :ostatus do
	plug(:accepts, ["html", "xml", "rss", "atom", "activity+json", "json"])
	plug(Pleroma.Plugs.StaticFEPlug)
	end

	pipeline :oembed do
	plug(:accepts, ["json", "xml"])
	end

	scope "/", Pleroma.Web do
	pipe_through(:ostatus)
	pipe_through(:http_signature)

	get("/objects/:uuid", OStatus.OStatusController, :object)
	get("/activities/:uuid", OStatus.OStatusController, :activity)
	get("/notice/:id", OStatus.OStatusController, :notice)
	get("/notice/:id/embed_player", OStatus.OStatusController, :notice_player)

	get("/users/:nickname/feed", Feed.UserController, :feed, as: :user_feed)
	get("/users/:nickname", Feed.UserController, :feed_redirect, as: :user_feed)

	get("/tags/:tag", Feed.TagController, :feed, as: :tag_feed)
	end

	scope "/", Pleroma.Web do
	pipe_through(:browser)
	get("/mailer/unsubscribe/:token", Mailer.SubscriptionController, :unsubscribe)
	end

	# Server to Server (S2S) AP interactions
	pipeline :activitypub do
	plug(:accepts, ["activity+json", "json"])
	plug(Pleroma.Web.Plugs.HTTPSignaturePlug)
	plug(Pleroma.Web.Plugs.MappedSignatureToIdentityPlug)
	end

	scope "/", Pleroma.Web.ActivityPub do
	# XXX: not really ostatus
	pipe_through(:ostatus)

	get("/users/:nickname/outbox", ActivityPubController, :outbox)
	end

	# Client to Server (C2S) AP interactions
	pipeline :activitypub_client do
	plug(:accepts, ["activity+json", "json"])
	plug(:fetch_session)
	plug(Pleroma.Plugs.OAuthPlug)
	plug(Pleroma.Plugs.BasicAuthDecoderPlug)
	plug(Pleroma.Plugs.UserFetcherPlug)
	plug(Pleroma.Plugs.SessionAuthenticationPlug)
	plug(Pleroma.Plugs.LegacyAuthenticationPlug)
	plug(Pleroma.Plugs.AuthenticationPlug)
	plug(Pleroma.Plugs.UserEnabledPlug)
	plug(Pleroma.Plugs.SetUserSessionIdPlug)
	plug(Pleroma.Plugs.EnsureUserKeyPlug)
	end

	scope "/", Pleroma.Web.ActivityPub do
	pipe_through([:activitypub_client])

	get("/api/ap/whoami", ActivityPubController, :whoami)
	get("/users/:nickname/inbox", ActivityPubController, :read_inbox)

	post("/users/:nickname/outbox", ActivityPubController, :update_outbox)
	post("/api/ap/upload_media", ActivityPubController, :upload_media)

	get("/users/:nickname/followers", ActivityPubController, :followers)
	get("/users/:nickname/following", ActivityPubController, :following)
	end

	scope "/", Pleroma.Web.ActivityPub do
	pipe_through(:activitypub)
	post("/inbox", ActivityPubController, :inbox)
	post("/users/:nickname/inbox", ActivityPubController, :inbox)
	end

	scope "/relay", Pleroma.Web.ActivityPub do
	pipe_through(:ap_service_actor)

	get("/", ActivityPubController, :relay)

	scope [] do
	pipe_through(:http_signature)
	post("/inbox", ActivityPubController, :inbox)
	end

	get("/following", ActivityPubController, :relay_following)
	get("/followers", ActivityPubController, :relay_followers)
	end

	scope "/internal/fetch", Pleroma.Web.ActivityPub do
	pipe_through(:ap_service_actor)

	get("/", ActivityPubController, :internal_fetch)
	post("/inbox", ActivityPubController, :inbox)
	end

	scope "/.well-known", Pleroma.Web do
	pipe_through(:well_known)

	get("/host-meta", WebFinger.WebFingerController, :host_meta)
	get("/webfinger", WebFinger.WebFingerController, :webfinger)
	get("/nodeinfo", Nodeinfo.NodeinfoController, :schemas)
	end

	scope "/nodeinfo", Pleroma.Web do
	get("/:version", Nodeinfo.NodeinfoController, :nodeinfo)
	end

	scope "/", Pleroma.Web do
	pipe_through(:api)

	get("/web/manifest.json", MastoFEController, :manifest)
	end

	scope "/", Pleroma.Web do
	pipe_through(:mastodon_html)

	get("/web/login", MastodonAPI.AuthController, :login)
	delete("/auth/sign_out", MastodonAPI.AuthController, :logout)

	post("/auth/password", MastodonAPI.AuthController, :password_reset)

	get("/web/*path", MastoFEController, :index)
	end

	pipeline :remote_media do
	end

	scope "/proxy/", Pleroma.Web.MediaProxy do
	pipe_through(:remote_media)

	get("/:sig/:url", MediaProxyController, :remote)
	get("/:sig/:url/:filename", MediaProxyController, :remote)
	end

	if Pleroma.Config.get(:env) == :dev do
	scope "/dev" do
	pipe_through([:mailbox_preview])

	forward("/mailbox", Plug.Swoosh.MailboxPreview, base_path: "/dev/mailbox")
	end
	end

	scope "/", Pleroma.Web.MongooseIM do
	get("/user_exists", MongooseIMController, :user_exists)
	get("/check_password", MongooseIMController, :check_password)
	end

	scope "/", Fallback do
	get("/registration/:token", RedirectController, :registration_page)
	get("/:maybe_nickname_or_id", RedirectController, :redirector_with_meta)
	get("/api*path", RedirectController, :api_not_implemented)
	get("/*path", RedirectController, :redirector)

	options("/*path", RedirectController, :empty)
	end
	end
	diff --git a/lib/pleroma/web/twitter_api/twitter_api_controller.ex b/lib/pleroma/web/twitter_api/twitter_api_controller.ex
	index 0229aea975..31adc28174 100644
	--- a/lib/pleroma/web/twitter_api/twitter_api_controller.ex
	+++ b/lib/pleroma/web/twitter_api/twitter_api_controller.ex
	@@ -1,88 +1,90 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.TwitterAPI.Controller do
	use Pleroma.Web, :controller

	alias Pleroma.Notification
	alias Pleroma.Plugs.OAuthScopesPlug
	alias Pleroma.User
	alias Pleroma.Web.OAuth.Token
	alias Pleroma.Web.TwitterAPI.TokenView

	require Logger

	plug(OAuthScopesPlug, %{scopes: ["write:notifications"]} when action == :notifications_read)

	+ plug(:skip_plug, OAuthScopesPlug when action in [:oauth_tokens, :revoke_token])
	+
	plug(Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug)

	action_fallback(:errors)

	def confirm_email(conn, %{"user_id" => uid, "token" => token}) do
	with %User{} = user <- User.get_cached_by_id(uid),
	true <- user.local and user.confirmation_pending and user.confirmation_token == token,
	{:ok, _} <-
	user
	\|> User.confirmation_changeset(need_confirmation: false)
	\|> User.update_and_set_cache() do
	redirect(conn, to: "/")
	end
	end

	def oauth_tokens(%{assigns: %{user: user}} = conn, _params) do
	with oauth_tokens <- Token.get_user_tokens(user) do
	conn
	\|> put_view(TokenView)
	\|> render("index.json", %{tokens: oauth_tokens})
	end
	end

	def revoke_token(%{assigns: %{user: user}} = conn, %{"id" => id} = _params) do
	Token.delete_user_token(user, id)

	json_reply(conn, 201, "")
	end

	def errors(conn, {:param_cast, _}) do
	conn
	\|> put_status(400)
	\|> json("Invalid parameters")
	end

	def errors(conn, _) do
	conn
	\|> put_status(500)
	\|> json("Something went wrong")
	end

	defp json_reply(conn, status, json) do
	conn
	\|> put_resp_content_type("application/json")
	\|> send_resp(status, json)
	end

	def notifications_read(%{assigns: %{user: user}} = conn, %{"latest_id" => latest_id} = params) do
	Notification.set_read_up_to(user, latest_id)

	notifications = Notification.for_user(user, params)

	conn
	# XXX: This is a hack because pleroma-fe still uses that API.
	\|> put_view(Pleroma.Web.MastodonAPI.NotificationView)
	\|> render("index.json", %{notifications: notifications, for: user})
	end

	def notifications_read(%{assigns: %{user: _user}} = conn, _) do
	bad_request_reply(conn, "You need to specify latest_id")
	end

	defp bad_request_reply(conn, error_message) do
	json = error_json(conn, error_message)
	json_reply(conn, 400, json)
	end

	defp error_json(conn, error_message) do
	%{"error" => error_message, "request" => conn.request_path} \|> Jason.encode!()
	end
	end
	diff --git a/lib/pleroma/web/web.ex b/lib/pleroma/web/web.ex
	index cf3ac1287b..1af29ce788 100644
	--- a/lib/pleroma/web/web.ex
	+++ b/lib/pleroma/web/web.ex
	@@ -1,109 +1,132 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web do
	@moduledoc """
	A module that keeps using definitions for controllers,
	views and so on.

	This can be used in your application as:

	use Pleroma.Web, :controller
	use Pleroma.Web, :view

	The definitions below will be executed for every view,
	controller, etc, so keep them short and clean, focused
	on imports, uses and aliases.

	Do NOT define functions inside the quoted expressions
	below.
	"""

	def controller do
	quote do
	use Phoenix.Controller, namespace: Pleroma.Web

	import Plug.Conn
	import Pleroma.Web.Gettext
	import Pleroma.Web.Router.Helpers
	import Pleroma.Web.TranslationHelpers

	+ alias Pleroma.Plugs.PlugHelper
	+
	plug(:set_put_layout)

	defp set_put_layout(conn, _) do
	put_layout(conn, Pleroma.Config.get(:app_layout, "app.html"))
	end
	+
	+ # Marks a plug as intentionally skipped
	+ # (states that the plug is not called for a good reason, not by a mistake)
	+ defp skip_plug(conn, plug_module) do
	+ PlugHelper.append_to_skipped_plugs(conn, plug_module)
	+ end
	+
	+ # Here we can apply before-action hooks (e.g. verify whether auth checks were preformed)
	+ defp action(conn, params) do
	+ if conn.private[:auth_expected] &&
	+ not PlugHelper.plug_called_or_skipped?(conn, Pleroma.Plugs.OAuthScopesPlug) do
	+ conn
	+ \|> render_error(
	+ :forbidden,
	+ "Security violation: OAuth scopes check was neither handled nor explicitly skipped."
	+ )
	+ \|> halt()
	+ else
	+ super(conn, params)
	+ end
	+ end
	end
	end

	def view do
	quote do
	use Phoenix.View,
	root: "lib/pleroma/web/templates",
	namespace: Pleroma.Web

	# Import convenience functions from controllers
	import Phoenix.Controller, only: [get_csrf_token: 0, get_flash: 2, view_module: 1]

	import Pleroma.Web.ErrorHelpers
	import Pleroma.Web.Gettext
	import Pleroma.Web.Router.Helpers

	require Logger

	@doc "Same as `render/3` but wrapped in a rescue block"
	def safe_render(view, template, assigns \\ %{}) do
	Phoenix.View.render(view, template, assigns)
	rescue
	error ->
	Logger.error(
	"#{__MODULE__} failed to render #{inspect({view, template})}\n" <>
	Exception.format(:error, error, __STACKTRACE__)
	)

	nil
	end

	@doc """
	Same as `render_many/4` but wrapped in rescue block.
	"""
	def safe_render_many(collection, view, template, assigns \\ %{}) do
	Enum.map(collection, fn resource ->
	as = Map.get(assigns, :as) \|\| view.__resource__
	assigns = Map.put(assigns, as, resource)
	safe_render(view, template, assigns)
	end)
	\|> Enum.filter(& &1)
	end
	end
	end

	def router do
	quote do
	use Phoenix.Router
	# credo:disable-for-next-line Credo.Check.Consistency.MultiAliasImportRequireUse
	import Plug.Conn
	import Phoenix.Controller
	end
	end

	def channel do
	quote do
	# credo:disable-for-next-line Credo.Check.Consistency.MultiAliasImportRequireUse
	use Phoenix.Channel
	import Pleroma.Web.Gettext
	end
	end

	@doc """
	When used, dispatch to the appropriate controller/view/etc.
	"""
	defmacro __using__(which) when is_atom(which) do
	apply(__MODULE__, which, [])
	end

	def base_url do
	Pleroma.Web.Endpoint.url()
	end
	end
	diff --git a/test/web/mastodon_api/controllers/suggestion_controller_test.exs b/test/web/mastodon_api/controllers/suggestion_controller_test.exs
	index c697a39f8b..8d0e70db86 100644
	--- a/test/web/mastodon_api/controllers/suggestion_controller_test.exs
	+++ b/test/web/mastodon_api/controllers/suggestion_controller_test.exs
	@@ -1,46 +1,20 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.SuggestionControllerTest do
	use Pleroma.Web.ConnCase

	alias Pleroma.Config

	- import Pleroma.Factory
	- import Tesla.Mock
	-
	setup do: oauth_access(["read"])

	- setup %{user: user} do
	- other_user = insert(:user)
	- host = Config.get([Pleroma.Web.Endpoint, :url, :host])
	- url500 = "http://test500?#{host}&#{user.nickname}"
	- url200 = "http://test200?#{host}&#{user.nickname}"
	-
	- mock(fn
	- %{method: :get, url: ^url500} ->
	- %Tesla.Env{status: 500, body: "bad request"}
	-
	- %{method: :get, url: ^url200} ->
	- %Tesla.Env{
	- status: 200,
	- body:
	- ~s([{"acct":"yj455","avatar":"https://social.heldscal.la/avatar/201.jpeg","avatar_static":"https://social.heldscal.la/avatar/s/201.jpeg"}, {"acct":"#{
	- other_user.ap_id
	- }","avatar":"https://social.heldscal.la/avatar/202.jpeg","avatar_static":"https://social.heldscal.la/avatar/s/202.jpeg"}])
	- }
	- end)
	-
	- [other_user: other_user]
	- end
	-
	test "returns empty result", %{conn: conn} do
	res =
	conn
	\|> get("/api/v1/suggestions")
	\|> json_response(200)

	assert res == []
	end
	end
	diff --git a/test/web/pleroma_api/controllers/pleroma_api_controller_test.exs b/test/web/pleroma_api/controllers/pleroma_api_controller_test.exs
	index 32250f06f6..8f0cbe9b25 100644
	--- a/test/web/pleroma_api/controllers/pleroma_api_controller_test.exs
	+++ b/test/web/pleroma_api/controllers/pleroma_api_controller_test.exs
	@@ -1,279 +1,279 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.PleromaAPI.PleromaAPIControllerTest do
	use Pleroma.Web.ConnCase

	alias Pleroma.Conversation.Participation
	alias Pleroma.Notification
	alias Pleroma.Object
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.CommonAPI

	import Pleroma.Factory

	test "PUT /api/v1/pleroma/statuses/:id/reactions/:emoji", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(user, %{"status" => "#cofe"})

	result =
	conn
	\|> assign(:user, other_user)
	\|> assign(:token, insert(:oauth_token, user: other_user, scopes: ["write:statuses"]))
	\|> put("/api/v1/pleroma/statuses/#{activity.id}/reactions/☕")
	\|> json_response(200)

	# We return the status, but this our implementation detail.
	assert %{"id" => id} = result
	assert to_string(activity.id) == id

	assert result["pleroma"]["emoji_reactions"] == [
	%{"name" => "☕", "count" => 1, "me" => true}
	]
	end

	test "DELETE /api/v1/pleroma/statuses/:id/reactions/:emoji", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(user, %{"status" => "#cofe"})
	{:ok, activity, _object} = CommonAPI.react_with_emoji(activity.id, other_user, "☕")

	result =
	conn
	\|> assign(:user, other_user)
	\|> assign(:token, insert(:oauth_token, user: other_user, scopes: ["write:statuses"]))
	\|> delete("/api/v1/pleroma/statuses/#{activity.id}/reactions/☕")

	assert %{"id" => id} = json_response(result, 200)
	assert to_string(activity.id) == id

	object = Object.normalize(activity)

	assert object.data["reaction_count"] == 0
	end

	test "GET /api/v1/pleroma/statuses/:id/reactions", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)
	doomed_user = insert(:user)

	{:ok, activity} = CommonAPI.post(user, %{"status" => "#cofe"})

	result =
	conn
	\|> get("/api/v1/pleroma/statuses/#{activity.id}/reactions")
	\|> json_response(200)

	assert result == []

	{:ok, _, _} = CommonAPI.react_with_emoji(activity.id, other_user, "🎅")
	{:ok, _, _} = CommonAPI.react_with_emoji(activity.id, doomed_user, "🎅")

	User.perform(:delete, doomed_user)

	result =
	conn
	\|> get("/api/v1/pleroma/statuses/#{activity.id}/reactions")
	\|> json_response(200)

	[%{"name" => "🎅", "count" => 1, "accounts" => [represented_user], "me" => false}] = result

	assert represented_user["id"] == other_user.id

	result =
	conn
	\|> assign(:user, other_user)
	\|> assign(:token, insert(:oauth_token, user: other_user, scopes: ["read:statuses"]))
	\|> get("/api/v1/pleroma/statuses/#{activity.id}/reactions")
	\|> json_response(200)

	assert [%{"name" => "🎅", "count" => 1, "accounts" => [_represented_user], "me" => true}] =
	result
	end

	test "GET /api/v1/pleroma/statuses/:id/reactions/:emoji", %{conn: conn} do
	user = insert(:user)
	other_user = insert(:user)

	{:ok, activity} = CommonAPI.post(user, %{"status" => "#cofe"})

	result =
	conn
	\|> get("/api/v1/pleroma/statuses/#{activity.id}/reactions/🎅")
	\|> json_response(200)

	assert result == []

	{:ok, _, _} = CommonAPI.react_with_emoji(activity.id, other_user, "🎅")
	{:ok, _, _} = CommonAPI.react_with_emoji(activity.id, other_user, "☕")

	result =
	conn
	\|> get("/api/v1/pleroma/statuses/#{activity.id}/reactions/🎅")
	\|> json_response(200)

	[%{"name" => "🎅", "count" => 1, "accounts" => [represented_user], "me" => false}] = result

	assert represented_user["id"] == other_user.id
	end

	test "/api/v1/pleroma/conversations/:id" do
	user = insert(:user)
	%{user: other_user, conn: conn} = oauth_access(["read:statuses"])

	{:ok, _activity} =
	CommonAPI.post(user, %{"status" => "Hi @#{other_user.nickname}!", "visibility" => "direct"})

	[participation] = Participation.for_user(other_user)

	result =
	conn
	\|> get("/api/v1/pleroma/conversations/#{participation.id}")
	\|> json_response(200)

	assert result["id"] == participation.id \|> to_string()
	end

	test "/api/v1/pleroma/conversations/:id/statuses" do
	user = insert(:user)
	%{user: other_user, conn: conn} = oauth_access(["read:statuses"])
	third_user = insert(:user)

	{:ok, _activity} =
	CommonAPI.post(user, %{"status" => "Hi @#{third_user.nickname}!", "visibility" => "direct"})

	{:ok, activity} =
	CommonAPI.post(user, %{"status" => "Hi @#{other_user.nickname}!", "visibility" => "direct"})

	[participation] = Participation.for_user(other_user)

	{:ok, activity_two} =
	CommonAPI.post(other_user, %{
	"status" => "Hi!",
	"in_reply_to_status_id" => activity.id,
	"in_reply_to_conversation_id" => participation.id
	})

	result =
	conn
	\|> get("/api/v1/pleroma/conversations/#{participation.id}/statuses")
	\|> json_response(200)

	assert length(result) == 2

	id_one = activity.id
	id_two = activity_two.id
	assert [%{"id" => ^id_one}, %{"id" => ^id_two}] = result
	end

	test "PATCH /api/v1/pleroma/conversations/:id" do
	%{user: user, conn: conn} = oauth_access(["write:conversations"])
	other_user = insert(:user)

	{:ok, _activity} = CommonAPI.post(user, %{"status" => "Hi", "visibility" => "direct"})

	[participation] = Participation.for_user(user)

	participation = Repo.preload(participation, :recipients)

	user = User.get_cached_by_id(user.id)
	assert [user] == participation.recipients
	assert other_user not in participation.recipients

	result =
	conn
	\|> patch("/api/v1/pleroma/conversations/#{participation.id}", %{
	"recipients" => [user.id, other_user.id]
	})
	\|> json_response(200)

	assert result["id"] == participation.id \|> to_string

	[participation] = Participation.for_user(user)
	participation = Repo.preload(participation, :recipients)

	assert user in participation.recipients
	assert other_user in participation.recipients
	end

	test "POST /api/v1/pleroma/conversations/read" do
	user = insert(:user)
	- %{user: other_user, conn: conn} = oauth_access(["write:notifications"])
	+ %{user: other_user, conn: conn} = oauth_access(["write:conversations"])

	{:ok, _activity} =
	CommonAPI.post(user, %{"status" => "Hi @#{other_user.nickname}", "visibility" => "direct"})

	{:ok, _activity} =
	CommonAPI.post(user, %{"status" => "Hi @#{other_user.nickname}", "visibility" => "direct"})

	[participation2, participation1] = Participation.for_user(other_user)
	assert Participation.get(participation2.id).read == false
	assert Participation.get(participation1.id).read == false
	assert User.get_cached_by_id(other_user.id).unread_conversation_count == 2

	[%{"unread" => false}, %{"unread" => false}] =
	conn
	\|> post("/api/v1/pleroma/conversations/read", %{})
	\|> json_response(200)

	[participation2, participation1] = Participation.for_user(other_user)
	assert Participation.get(participation2.id).read == true
	assert Participation.get(participation1.id).read == true
	assert User.get_cached_by_id(other_user.id).unread_conversation_count == 0
	end

	describe "POST /api/v1/pleroma/notifications/read" do
	setup do: oauth_access(["write:notifications"])

	test "it marks a single notification as read", %{user: user1, conn: conn} do
	user2 = insert(:user)
	{:ok, activity1} = CommonAPI.post(user2, %{"status" => "hi @#{user1.nickname}"})
	{:ok, activity2} = CommonAPI.post(user2, %{"status" => "hi @#{user1.nickname}"})
	{:ok, [notification1]} = Notification.create_notifications(activity1)
	{:ok, [notification2]} = Notification.create_notifications(activity2)

	response =
	conn
	\|> post("/api/v1/pleroma/notifications/read", %{"id" => "#{notification1.id}"})
	\|> json_response(:ok)

	assert %{"pleroma" => %{"is_seen" => true}} = response
	assert Repo.get(Notification, notification1.id).seen
	refute Repo.get(Notification, notification2.id).seen
	end

	test "it marks multiple notifications as read", %{user: user1, conn: conn} do
	user2 = insert(:user)
	{:ok, _activity1} = CommonAPI.post(user2, %{"status" => "hi @#{user1.nickname}"})
	{:ok, _activity2} = CommonAPI.post(user2, %{"status" => "hi @#{user1.nickname}"})
	{:ok, _activity3} = CommonAPI.post(user2, %{"status" => "HIE @#{user1.nickname}"})

	[notification3, notification2, notification1] = Notification.for_user(user1, %{limit: 3})

	[response1, response2] =
	conn
	\|> post("/api/v1/pleroma/notifications/read", %{"max_id" => "#{notification2.id}"})
	\|> json_response(:ok)

	assert %{"pleroma" => %{"is_seen" => true}} = response1
	assert %{"pleroma" => %{"is_seen" => true}} = response2
	assert Repo.get(Notification, notification1.id).seen
	assert Repo.get(Notification, notification2.id).seen
	refute Repo.get(Notification, notification3.id).seen
	end

	test "it returns error when notification not found", %{conn: conn} do
	response =
	conn
	\|> post("/api/v1/pleroma/notifications/read", %{"id" => "22222222222222"})
	\|> json_response(:bad_request)

	assert response == %{"error" => "Cannot get notification"}
	end
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Sat, Mar 7, 11:09 AM (20 h, 2 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1164080
Default Alt Text: (90 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions